CERT-InCVELIST:CVE-2023-30466CVE-2023-30466 Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
68.9%
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.
Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "NVR MS-Nxxxx-xxG",
"vendor": "Milesight",
"versions": [
{
"lessThan": "77.9.0.18-r2",
"status": "affected",
"version": "77.X",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NVR MS-Nxxxx-xxE",
"vendor": "Milesight",
"versions": [
{
"lessThan": "75.9.0.18-r2",
"status": "affected",
"version": "75.X",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NVR MS-Nxxxx-xxT",
"vendor": "Milesight",
"versions": [
{
"lessThan": "72.9.0.18-r2",
"status": "affected",
"version": "72.X",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NVR MS-Nxxxx-xxH ",
"vendor": "Milesight",
"versions": [
{
"lessThan": "71.9.0.18-r2",
"status": "affected",
"version": "71.X",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NVR MS-Nxxxx-xxC",
"vendor": "Milesight",
"versions": [
{
"lessThan": "73.9.0.18-r2",
"status": "affected",
"version": "73.X",
"versionType": "custom"
}
]
}
]Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
68.9%